CVE-2026-31282

Description

• Totara LMS is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form and bypass Octa login. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack to obtain a user credentials.

---

CVSS 3 Score: 9.1 (Critical)

---

Attack Type

• Remote (Unauthenticated)

---

Affected Versions

• Versions before <= 19.1.5

---

Vendor of Product

• Totara

---

Affected Product Code Base

• Totara LMS

---

Affected Component

• login Page.

---

Mitigations

• Login form validation should rely on server-side verification not only client-side, and rate-limit should be implmented on the login form to prevent brute force attacks.

---

Vulnerability Details

• Totara LMS is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form and bypass Octa login. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack to obtain a user credentials.

---

Fixed versions

• Versions after > 19.1.5

---

Discovered By:

• Yazan Abu-Nadi